Have You Received a Suspicious Email Asking for a Signature? It Could Be an E-Signature Scam

• E-signature scams are rising as remote workers rely more on services like DocuSign, HelloSign and other similar services. Recently, some employees at the Identity Theft Resource Center (ITRC) received phishing emails that claimed to have an invoice to sign that was attached to the email.  
• Other e-signature email scams ask people to enter their personal and financial information, claiming that they either have a notification or their account was suspended.  
• These e-signature scams and phishing attacks can lead to malware and stolen personal and financial data used to commit different forms of identity crimes.  
• To avoid these scams, you should ignore any emails you are not expecting, never click on any unknown links and reach out directly to the person the email claims to come from to verify the validity of the message.  
• If anyone believes they are a victim of an e-signature scam or wants to learn more, they can contact the ITRC toll-free by phone (888.400.5530) or live-chat. Just go to www.idtheftcenter.org to get started.  

DocuSign and similar services that offer verified electronic signatures have grown in popularity since COVID-19. According to one e-signature company’s recent financial report, their total revenue has increased by more than 50 percent. It’s no surprise more people need the services of an e-signature company. It is also no surprise that e-signature scams are spiking as a result. Multiple Identity Theft Resource Center (ITRC) employees recently received emails claiming to be from DocuSign with “invoices” attached: 

While convenient, e-signature services give threat actors another way to steal identities and financial and personal data. Consumers should keep an eye out for e-signature email scams so they don’t fall victim to a phishing attack.  

Who are the Targets? 

DocuSign users; Email users; Employees 

What is the Scam? 

In the latest e-signature scams, criminals send phishing emails claiming to come from “DocuSign Electronic Service.” The subject line typically tells users they received an invoice or notification from a service – DocuSign Electronic Service – for example. The emails contain malicious attachments that could lead to malware. Other e-signature scams tell people that they have a notification or their account is suspended and to click on a link and enter their personal and financial information. 

What They Want 

Criminals commit malware attacks and steal people’s personal and financial information to execute an array of identity crimes. They use the information to access people’s bank accounts, credit card accounts and work accounts, or they sell the personal information to other criminals. 

How to Avoid Being Scammed 

• If you have not been requested to sign any documents, be wary of an email asking you to sign something. It is probably a phishing attack. 
• Look for misspellings in the email. Sometimes scammers will alter a letter in the sender’s email address, hoping you do not notice. For example, if it is a DocuSign email scam, the sender address may be “@docsgn.com” instead of “@docusign.com.” 
• Always check the sender’s email. If the email comes from an address or name you do not recognize, ignore it. If it claims to be from someone you work with, contact that person directly and ask them if they sent you the document. 
• Never click on any links in an email you are not expecting. Instead, contact the source of the email directly to verify the validity of the email. 
• If you’ve receive a phishing email, report it. You can report it to the Federal Trade Commission at www.ftc.gov/complaint.  

To learn more about e-signature scams, or if you believe you were the victim of an e-signature email scam, contact the ITRC toll-free by calling 888.400.5530. You can also visit the company website to live-chat with an expert advisor. Go to www.idtheftcenter.org to get started.